CVE-2026-94171: WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability
Published Sep 30, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.
Affected Software
1 affected component
Villatheme CURCY=2.2.18
Event History
Sep 30, 2026
CVE Published
via MITRE·05:38 PM
Data Sourced
via MITRE·05:38 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges to attempt exploitation. The attack vector is network-based and requires user interaction.
2
What impact could successful exploitation have?
Successful exploitation may affect confidentiality, integrity, and availability at a low level, with scope changed. The supplied severity vector rates the issue 7.1 (High).
3
Which plugin versions are affected?
CURCY versions 2.2.16 and earlier are identified as affected. The provided data does not identify a fixed version.